It’s 2023, why are websites actively preventing pasting into fields like passwords and credit card number boxes? I use a password manager for security, it’s recommended by my employer to use one, and it even avoids human error like accidentally fat-fingering keys, and best of all with the credit card number I don’t have to memorize anything or know a single digit/character!

I have to use the Don’t Fuck With Paste addon just to be able to paste my secrets into certain monthly billing websites; why is my electric provider and one of my banks so asinine that pasting cannot be allowed? I can only imagine downsides and zero upsides to this toxic dark-pattern behavior.

There is even a mention about this in NIST SP 800-63B, a standard for identity management that some companies must follow in the USA, which mentions forcefully rotating passwords and denying “password paste-in” as antiquated/bad advice:

Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This facilitates the use of password managers, which are widely used and in many cases increase the likelihood that users will choose stronger memorized secrets

Edit: I discovered that for Firefox users there’s a simpler way than exposing your secrets to someone’s third-party addon. Simply open about:config, search for dom.event.clipboardevents.enabled, and change it from true to false.

Edit 2: As some have pointed out, that config value interferes with regular functionality on some sites. Probably best to leave it alone unless you know what you’re doing.

  • RIP_Apollo@feddit.chEnglish
    1·
    1 year ago

    Yes I’ve made a similar mistake in the past. On one screen I performed the auto-type and it was in the process of typing out the user/password combination, and while this was happening I clicked into a chat window on my other screen without thinking. The chat window immediately started having part of my password typing into it!

    Luckily I managed to click elsewhere in time to prevent ‘enter’ being typed at the end of auto-type.

    It’s just a reminder that you have to wait for auto-type to complete before you can do anything else.

    The UI isn’t obvious into which window it will autotype

    I found that if you click into the username field first and then switch directly to KeePass without opening/switching to any other applications in between, then when you click auto-type in KeePass, it works every time. This is because the browser window was the last used application before KeePass was selected. But yeah, it’s not an ideal user experience.